[PATCH] tools/wmi: dell-smbios-example: fix 1-byte stack overflow in find_token()

[Haoran Wang]

find_token() builds sysfs paths for Dell SMBIOS token files with sprintf
into stack buffers that are sized to the formatted string length but miss
the NUL terminator.

    char value_sysfs[57];
    sprintf(value_sysfs, "%s/%04x_value", token_sysfs, token);
    char location_sysfs[60];
    sprintf(location_sysfs, "%s/%04x_location", token_sysfs, token);

token_sysfs is the 46-char static const literal
"/sys/bus/platform/devices/dell-smbios.0/tokens" and token is a __u16
(always exactly four hex digits via %04x), so the formatted strings are

    46 + 1 + 4 + 6 = 57 chars  (".../XXXX_value")
    46 + 1 + 4 + 9 = 60 chars  (".../XXXX_location")

plus the NUL that sprintf writes one byte past each buffer
(value_sysfs[57] / location_sysfs[60]).  Callers pass only the fixed u16
constants CAPSULE_EN_TOKEN / CAPSULE_DIS_TOKEN, so this 1-byte stack OOB
is deterministic on every invocation (the sprintf runs before the fopen,
so it fires regardless of whether the sysfs file exists).

token_sysfs and token are compile-time-bounded, so sizing each buffer to
hold the terminator (57 to 58, 60 to 61) fully removes the OOB.

Signed-off-by: Haoran Wang <haoranwangsec@xxxxxxxxx>
---
 tools/wmi/dell-smbios-example.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/wmi/dell-smbios-example.c b/tools/wmi/dell-smbios-example.c
index 1f3e7ab14..214071f6f 100644
--- a/tools/wmi/dell-smbios-example.c
+++ b/tools/wmi/dell-smbios-example.c
@@ -52,8 +52,8 @@ static int run_wmi_smbios_cmd(struct dell_wmi_smbios_buffer *buffer)
 
 static int find_token(__u16 token, __u16 *location, __u16 *value)
 {
-	char location_sysfs[60];
-	char value_sysfs[57];
+	char location_sysfs[61];
+	char value_sysfs[58];
 	char buf[4096];
 	FILE *f;
 	int ret;